Practitioner's Docket No. NAI1PO20/01.139.OI 



PATENT 



IN THF I N1TKD M WFSP WENT AND TRADEMARK OFFICE 

In re -ipphcifif n of ( hiis \ Baiton <.t al 

\ppf«.anonNo 0^ M>0 Group No. : 2 i 37 

Filed u" 2ft 2(*H Examiner; Pvawha. Michael X 

f«>i S\MtM ML i HOI) WD COMP? 1'ER PROGRAM PRODUCT FOR ANTI-VIRUS 

SC. \\\f\Gl\ Ai>10R\Gl SIBVs'SflM 

Mad Stop Vppeal BriHk - Patents 
( ommivsioner for Patents 
P.O. Hi>\ 1450 

Alexandria, \ V 22313-1450 

TRANSMITTAL OF APPEAL BRIEF 
(PATENT APPLICATION— 37 CF.R. § 41.37) 

L This brief is in furtherance of the Notice of Appeal filed June 2, 2005, a substitute for the Appeal 
Brief fried October .13, 2005, and in response to the Notification of Non-Compliant Appeal Brief 
mailed on September 21, 2007. 

2, STATUS OF APPLICANT 

This application is on behalf of other than a small entity. 

3, FEE FOR FILING APPEAL BRIEF 

Pursuant to 37 C.F.R. § 4.1 .20(b)(2), the fee for filing the Appeal Brief is: 

other than a small entity 

Appeal Brief fee due 

4, EXTENSION OF TERM 

The proceedings herein are for a patent application and the provisions of 37 C.F.R. § 1.136 apply. 

Applicant believes that no extension of term is required. However, this conditional petition is being 
made to provide for the possibility that applicant has inadvertently overlooked the need for a 
petition and fee for extension of time. 



SSI 0.00 
$510.00 



Transmittal of Apps3.t. Brief—page J. of 2 



5. TOTAL FEE DUE 



The total fee due is: 



Appeal brief fee 
Extension fee (if any ) 



$0.00 (previously paid on July 7, 2t'X>5) 
$0.00 



TOTAL FEE DUE 



$0.00 



Vppbcant bche\es that u>> fees aie dik. sn tontKetioti with the itium oi tin? paper because the 
appeal bt tct fee w as pa td w ith a pi e\ i<~>u> submission I lov c\ et {Ik O nvmis- nmer is authorized to 
chaise an% addu-onai kes that mas be due ten fbt an\ season fneludav; but not limited to, fee 
changes etc ) to Deport \^ count No ^0-13^1 (OkIce No N -\1 1 Pu2< >t 

7. I'LLDfcHClhMY 

Tt an\ additional extension and oi fee is teqniad an J if am add' iion.i iec ior claims is required, 
Jui<-c Deposit Account No is? <Ordu V> WllPtPO) 



Datv Oetobei 22. Kf M\/lLk V 



fef \o t08-«7i-.'^ 
( usroiuei No 2 



Stuu^tute oi Praentionei 
ke\ m .1 /ilka 
/ilka-kotah, i\ 
PO Box ^2 n :o 



Transmittal of Apps3.t Brief— page 2 of 2 



PATENT 



IN THE UNITED STATES PATENT AND TRADEMARK OFFICE 

In re application of: ) 

) 

Barton et al. } Group Art Unit: 2137 

) 

Application No. 09/916,600 ) Examiner. Pyzocha, Michael I. 

) 

Filed: 07/26/2001 } Atty. Docket No. 

) NAUP020/0SJ39.O1 
For: SYSTEM. METHOD AN D COMPUTER ) 

PROGRAM PRODUCT FOR ANTI-VIRUS ) Date: 10/22/2007 

SCANNING IN A STORAGE SUBSYSTEM ) 
) 



Commissioner for Patents 
P.O. Box 1450 
Alexandria, VA 22313-1450 

ATTENTION: Board of Patent Appeals and Interferences 

SUBSTITUTE APPEAL BRIEF (37 C.F.R. § 41.37) 

This brief is in furtherance of the Notice of Appeal filed June 2, 2005 , a substitute for the Appeal 
Brief filed October 13, 2005, and in response to the Notification of Non-Compliant Appeal Brief 
mailed on September 2 L 2007 (see attached). While appellant disagrees with the Examiner as to 
whether the al leged deficiencies exist in the original Appeal Brief, a Substitute Appeal Brief with 
appropriate edits is nevertheless submitted to expedite prosecution. 



The fees required under § 1.17, and any required petition for extension of time for filing this 
brief and fees therefor, are dealt with in the accompanying TRANSMITTAL OF APPEAL 
BRIEF. 



This brief contains these items under the following headings, and in the order set forth below (37 
C.F.R. § 4L37(c)(i)): 



I REAL PARTY IN INTEREST 

II RELATED APPEALS AND INTERFERENCES 



HI STATUS OF CLAIMS 

IV STATUS OF AMENDMENTS 

V SUMM ARY OF CLAIMED SUBJECT MATTER 

VI GROUNDS OF REJECTION TO BE REVIEWED ON APPEAL 

VII ARGUMENT 

VIII CLAIMS APPENDIX 

IX EVIDENCE APPENDIX 

X RELATED PROCEEDING APPENDIX 



The final page of this brief bears the practitioner's signature. 
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I REAL PARTY IN INTEREST (37 C.F.R, § 407(e)(l)(i)) 

The real party in interest in this appeai is McAfee, Inc. 
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II RELATED APPEALS AND INTERFERENCES (37 C.RR. § 41.37(c) (l)(ti» 

With respect to other prior or pending appeals, interferences, or related judicial proceedings that 
will directly affect, or be directly affected by. or have a bearing on the Board's decision in the 
pending appeal, there are no other such appeals, interferences, or related judicial proceedings. 

A Related Proceedings Appendix is appended hereto. 
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III STATUS OF CLAIMS (37 C.F.R. § 4.07(c) (1)(iu)) 

A. TOTAL NUMBER OF CLAIMS IN APPLICATION 

Claims in the application are: 1 -2, 4-7, 10-12, J 4-1 8, 20-23 and 26-43 

B. STATUS OF ALL THE CLAIMS IN APPLI CATION 

1. Claims withdrawn from consideration: None 

2. Claims pending: i-2, 4-7, 10- 1 3, 14-18, 20-23 and 26-43 

3. Claims allowed; None 

4. Claims rejected: 1-2, 4-7, 10-1 3, 14-18, 20-23 and 26-43 

5. Claims cancelled: 3, 8-9, 19, and 24-25 

C. CLAIMS ON APPEAL 

The claims on appeal are: 1.-2, 4-7, 10-13, 14-1.8, 20-23 and 26-43 
See additional status information in the Appendix of Claims. 



IV STATUS OF AMENDMENTS (37 CF.R. § 4I.37(c)(l)(iv» 

As to the status of any amendment filed subsequent to final rejection, an amendment was filed 
04/28/2005 after a final rejection mailed 03/22/2005, which was not entered by the Examiner. 
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V SUMMARY OF CLAIMED SUBJECT MATTER (37 C.F.R. § 41.37(c)(l)(\)) 

\\ uh tespect to a summan of ( hum \ as shown m Figures 2 and I a method ior scanning data 
icad fiom stotage is prowded including i evening a iequc-1 ibi data sa\ed jh sloiagc uoni a 
central piot-cs^ing unit (e g Hem 402 u+T<guio 4} in use, the lequested data is scanned fot 
malicious code (e g item 40o of S-igure 4) and the data is ttansmiited fiom the stouye to die 
central processing unit it malicious code is not found in the data during the scanning {e g item 
410 of Figure 4) In addition the scanning is petlouned In a scanning module coupled to a 
sfotagc subsystem eoutiollei (e g items 208 and 204 off igwe 2) Furtheunuie a uset is 
allowed to disable the scanning module, and data is precluded iiom being transmitted from the 
storage to the ccntial ptocc-soing unit upon the disabling of the scanning module (e g items 404, 
1 1 S and 4 ! o oi Figure 4 ) Note page i> and page l} lino o ~ page H) lino ^ 5 , ioi esamplo 

\\ ith icspect to a summaix oi ( Lnm 1 "* as shown m Figtucs 2 and 4 a compute? progtam 
pioduct foi scanning data tead fiom stutage is pn>\sded Computei code is included foi 
lecon mg a lequest tot data sa\ed m stoiage fiom a ctnttal processing unit {o g item 402 of 
F italic H In addition computet code is included lot scanning the requested data foi malicious 
code te g item 40f> of Figuie 4) Computer code is also included foi transmitting the data horn 
the storage to the central piocessmg umt jf malicious code is not found in the data during the 
scanning te t> item 410 of Hguie 4) hurther the scanning is peitormed b\ a scanning module 
coupled to a storage <uhs\ ^tern conuoSlet (e g items 20S and 204 of rtgute 2) \b>o a nsct is 
allowed to disable the sc aiming module and data is pieeluded from being tiansnutied fumi the 
storage to the centtal processing unit upon the disabling of tire scanning module te *.< items 404, 
41£ and lio of Figuio U Note pa&eo, and page 0 , line 6 page 10, line 31 foi example 

With respect to a summary of CI aim 33, as shown in Figures 2 and 4, a method for scantling data 
written to storage is provided including receiving a request for data to be written in storage, the 

request being received from a central processing unit (e.g. item 402 of Figure 4), Further, the 
data is scanned for malicious code (e.g. item 406 of Figure 4). In addition, the data is written to 
the storage if malicious code is not found in the data during the scanning (e.g. item 410 of Figure 
4), The scanning is performed by a scanning module coupled to a storage subsystem controller 
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(e.g. items 208 and 204 of Figure 2). Also, a user is allowed to disable the scanning module, and 
data is precluded from being transmitted to the storage from the centra! processing unit upon the 
disabling of the scanning module (e.g. items 404, 418 and 416 of Figure 4). Note page 6, and 
page 9, Sine 6 ----- page 1 0, line 3 1 , for example. 

With respect to a summary of CI aim 34, as shown in Figures 2 and 4, a computer program 

product is provided for scanning data written to storage. Computer code is included for 
receiving a request for data to be written in storage, the request being received from a central 
processing unit (e.g. item 402 of Figure 4). Computer code is also included for scanning the data 
for malicious code (e.g. Item 406 of Figure 4). Still yet, computer code is included for writing 
the data to the storage if malicious code is not found in the data during the scanning (e.g. item 
410 of Figure 4). Further, the scanning is performed by a scanning module coupled to a storage 
subsystem controller (e.g. items 208 and 204 of Figure 2). Also, a user is allowed to disable the 
scanning module, and data is precluded from being transmitted to the storage from the central 
processing unit upon the disabling of the scanning module (e.g. items 404, 418 and 4 .16 of Figure 
4), Note page 6, and page 9, line 6 -• page 10, line 31, for example. 

With respect to a summary of Claim 35, the above summary of Claim I is incorporated, at least 
m pan, h\ tefeieueo 1 utthet prov ided >s a svncm that includes storage (t* g item 202 oi 1 rcme 
2 ! for saving data theiein a taorage subsvsteiii oonttoHu te u 2 ( >4 of Figute 2) coupled to the 
stotago for conttollmg access to the data sa\ed therein, and a tenttai piocessmg unit (e i> item 
20o of Figure 2 ) coupled to the stotago oiihs\ stem controller tot issuing tead tequcMs for leading 
the data sa\cd therein lot processing pi i poses and write icquests for writing data t<"> the storage 
Also inch ded is a scanuum module te g item 20S of hintre 2} coupled to the centtal piocesstng 
unit and the storage ^ubs\stem umti oiler The scanning module is adapted lot iduiufv mg the 
requests ftom the eential processing unit, and scanning the data foi malicious code m response to 
the requests An event manager module (e c item ^46 of I iguto ^ i is couplet! tu the scanning 
module and i!k LeMtai processing unu 1 lie e\ent man<tgei moduk is adapted fot aceiv ma 
results of the scanning from the scanning modi !e Hie e~v ent manage-i module is futther adapted 
to execute an event based on the results of the- scanning Vddmonalls the contra! processing unit 
is conditionally allowed to read the data >aved in the stotago and write data to the stoiage ba^ed 
on the results of the scanning (e.g. item 419 of Figure 4 and item 519 of Figure 5), and a user is 
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allowed to disable the scanning module. Further, data is precluded from being transmitted 
between the storage and the central processing unit upon the disabling of the scanning module 
(e.g. items 404, 418 and 416 of Figure 4). Note page 5, line 13-- page 12, line 23, for example. 

With respec t to a summary of Claim 3 9, the above summaries of Claims 1 and 35 a re 
niLOipniatcd at least in pan, hv icfetenee V futhei dliisuafcdm i igtue 2 a system us 
pit Aided foi scanning data read fioni stciaae, and includes means tut sauim data theiem (e a 
item 202 of figure 2) and means ten controlling an. ess to the data sa\ed thaem je u item 2Uo of 
Ftguie 2} hi addition, means tin issuing tead request aic mc hided tot leading the data saxed 
theiem foi pjoeessnjg putposes and wtite lequesis tot fining data to the stotage (e g item 204 
of Hguje 2> along with means tot uieuufwng tht requests tiom the central ptocessmg unit, and 
scanning the data foi malicious code in tesporioc to tht requests (e g item 208 of 1 igme 2) 
Fuithet included are means for lecetung icsults of the stanmni: fiom the scanning means and 
e\eemmg an e\ ent based on the iesults of the scanning fe g item 206 of figme 2 } Such means 
(e g stem 20o of Figure 2) is thus umditionaih allowed to lead the iL ta saxed m the sioiage and 
wine data to the stoiage based on the iesults of tae shantung (e g item 4! 9 of 1 tgute 4 and item 
5b) of Bguie M and a usei is allowed to disable the scanning means and dMa is pseeluded flora 
being tiarKinUsed between the stotage and such means upon the disabling of the st annum means 
(e.g. items 404, 418 and 416 of Figure 4). Note page 5, line 1.8 - page 6, line 23, for example. 
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VI GROUNDS OF REJECTION TO BE REVIEWED ON APPEAL (37 C.F.R. § 
41.37<cXl)(vi)) 

Following, under each issue listed, is a concise statement setting forth the corresponding ground 
of rejection. 

Issue # 1 : The Examiner has rejected Claim 42 under 35 U.S.C .112, first, paragraph, as 

providing new matter not originally described m the Specification. 

Issue # 2; The Examiner has rejected Claims 1-2, 4-7, 10-1 8, 20-23 and 26-40 under 35 U.S.C. 
103(a) as being unpatentable over Makita, U.S. Patent No. 2001/0007120, in view of Flint, U.S. 
Patent No. 6,735,700. 

issue # 3; The Examiner has rejected Claim 41 under 35 U.S.C. 103(a) as being unpatentable 
over Makita, U.S. Patent No. 2001/0007120, in view of Flint, U.S. Patent No. 6,735,700, in 

further view of Browne, U.S. Patent No. 6,272,533. 



VII ARGUMENT (37 C.F.R. § 4U7(c)(.l)(vli)) 



The claims of the groups noted below do not stand or fell together. In the present section, 
appellant explains why the claims of each group are believed to be separately patentable. 

Issue #1: 

The Examiner has rejected Claim 42 under 35 U.S.C, 1 12, first paragraph, as providing new 
matter not originally described in the Specification. 

Group Hi: (yams 42 and 43 

Specifically, the Examiner has stated that '[n]o where in the Specification does the appellant 
describe that it is determined whether the storage is disabled '"only after" determining whether 
the scanning module is disabled. ' Appellant respectfully disagrees with such rejection in view of 
the clear support for such claim language in Figure 5 of appellant's originally-filed application, 
as shown below. 
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Appellant points out step 504 of. Figure 5, wherein it is first determined whether the scanner is 
disabled Next, and onlv.jf the scanner has been disabled, as depicted by the Yes arrow from 
504. is it next determined if the storage is disabled (operation 51 S). Thus, operation 51 S occurs, 
as shown, only after operation 50-4 {and not after any other operations shown). To this end, 
appellant's claimed technique "wherein it is determined whether the storage is disabled only 
after determining whether the scanning module is disabled" (see Claim 42} is fully supported by 
the specification with regard to Figure 5. 

It is noted that the Examiner has rejected Claim 43 as being dependent on Claim 42. In view of 
the remarks made hereinabove, a notice of allowance or a specific prior art showing of ail, of 
such claim limitations, in combination with the remaining claim elements, is respectfully 
requested. 

issue #2: 

The Examiner has rejected Claims 1-2, 4-7, 10-18, 20-23 and 26-40 under 35 U.S.C. 103(a) as 
being unpatentable over Makita, U.S. Patent No. 2001/0007120, in view of Flint, U.S. Patent No. 
6,735,700. 

Group #./; Claims 1, 2, 4, 5, 10, 11, 15-17, IS, 20, 21, 26, 27, 31-34 and 39 

With respect to Claim I, the Examiner continues to rely on the following excerpt from Flint to 
meet appellant's claimed "wherein a user is allowed to disable the scanning module, and data is 
precluded from being transmitted from the storage to the central processing unit upon the 
disabling of the scann ing module." 



* -=>■>. r s.. If the user input specifies the 

termination of the anti -virus program {block 427) , a termination 
process illustrated by block 429 and described in more detail below in 
conjunction with FIG. 8 is performed - o , > s > - ^ s >*>, 1 ; 11 , 
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block 433. Such user input a.Lsc includes changing preilerenca paraiseters 
chat control the overall functioning oi: the anti-virus software. The 
user can also specify wnxch files to include in a pre-- defined scan set- 
that is used by the on-demand scan of FIG. 6. The handling of such user 
input is well understood in che art and is not discussed further. 
Moreover, it will be appreciated that the input interface is 
conventional and thus not illustrated." {Cel. 9, lines 5-24 - esr-phasis 
added) 

\ppeltunt icspectrulK asserts that the above exceipt ft cm hhnt ssmph disclose^ ' [i]f the usei 
input specifics the tot munition oi the ami-\ nus piogiam (block 127) a tei munition piotess 
iliusnafed b\ bluet 42s> and dci^nbed in nunc detail below m touunKtmn w tth H(j S is 
pei fosmed 1 I !ui&, I hot unk teaches a ti^er terminating tbe antt-\ uus piogram and not 1 data is 
ptetUicied from beine tumommed ftom the storage to the tents ai piocessmg unit upon the 
disabling oi the canning module " as daimed bx appellant 

lo Jus titer cLu if\ tins distinction appdlant iespecttulK points out hu ^ in Mint .g idvued to 
in the abm e exceipt SpeuftcalH I ig K toadies wntms to petmanem stuiage (block 80 >} e\csi 
attci <t use: has specified to terminate the d\\P~\ uus piogiam (block 42^ of Fig 4) Appellant 
icspcctittlh as#ert^ that this death iiw<.r, from appellant s claim language- since 

appellant speeiilealh dasms data is pi collided horn bung uansmnted fiom the stoiage to the 
central ptoccssmg unit upon th. disabling of the s,.anmmi module % (emphasis added) \Uov\ mg 
the data to be written to stotage oi toad ftom storage without fulh enmpletmga scan as m Phut, 
would pio\ ide the ojipotlumtv foi maheious code to e\euite and oi ptohierate on the s\ stems 
sought to be ptotected Vppdlant s claimed imention is death capabk of auudina such a 
situation. 

In the Advisory Action dated 5/16/2005, the Examiner has argued that Makita, in. combination 
with Flint, teaches appellant's claim language. Specifically, the Examiner has argued that 
Makita teaches "[tjlie storage location retrieves the data and performs an internal virus check on 
the data before it sends the data back to the cpu (host) ([0180]-[0184])." Additionally, the 
Examiner lias argued that Flint teaches the idea of a user being able to disable and enable a virus 
scanning module (Col. 9, lines 5-24). From this, the Examiner has concluded that the 
combination of such teachings meet appellant's claimed method "wherein a user is allowed to 
disable the scanning module, and data is precluded from being transmitted from the storage to 
the central processing unit upon the disabling of the scanning module.*" 
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Appellant respectfully disagrees. Makita merely teaches two scenarios. First, if a virus is found 
during the virus check, transmission to the host is stopped ([00183]), Second, if a vims is not 
found during the virus check, the information is transmitted to the host ([00184]). Clearly, there 
is no disclosure of the result when no virus check is performed, since Makita does not allow for 
this option. Thus, only appellant teaches and claims that "data is precluded from being 
transmitted from the storage to the centra! processing unit upon the disabl ing of the scanning 
module." 

To establish a prima facie case of obviousness, three basic criteria must be met. First, there must 
be some suggestion or motivation, either in the references themselves or in the knowledge 
generally available to one of ordinary skill in the art, to modify the reference or to combine 
reference teachings. Second, there must be a reasonable expectation of success. Finally, the prior 
art reference (or references when combined) must teach or suggest all the claim limitations. The 
teaching or suggestion to make the claimed combination and the reasonable expectation of 
success most both be found in the prior art- and not based on appellant's disclosure. In re 
Vaeck,941 F.2d 488, 20 USPQ2d 1438 (Fed.Cir.1991). 

Appellant respectfully asserts that at least the third element of the prima facie case of 
obviousness has not been met, since the prior art references, when combined, fail to teach or 
suggest all of the claim limitations, as noted above. A notice of allowance or a specific prior art 
showing of aJJ of appellant's claim limitations, in combination with the remaining claim 
elements, is respectfully requested. 

Group U 2: Claims 35-38 

With respect to independent Claim 35, the Examiner has relied on Figure 15 item 4.1 3 of Makita 
to make a prior art showing of appellant's claimed "scanning module coupled to the central 
processing unit and the storage subsystem controller, the scanning module adapted for 
identifying the requests from the central processing unit, and scanning the data for malicious 
code in response to the requests." 
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Appellant, respectfully asserts that item 413 of Figure 15 is a virus check unit to which 
"information to be recorded corresponding to the command is supplied" (see [0174] in Makita). 
Having information supplied to a virus check unit simply does not meet "scanning module 
adapted for identifying requests from the central processing unit," as claimed by appellant 
(emphasis added). 

Further, the Examiner has relied on Makita's disclosed file management unit (Figure 35 item 
21 1) and the following excerpts from Makita to make a prior art showing of appellant's claimed 
"event manager module coupled to the scanning module and the central processing unit, the 
even t manager module adapted for receiving resul ts of the scanning from the scanning module , 
the event manager module adapted to execute an event based on the results of the scanning": 



\ppJicUJt iespeesluib av-eit<- that a hie management unit that manages tiles man tges acees-, to 
files and manages the tin matting of file-, atom; v. tth stopping a transmission to the host 
computet w hen a \ nu-> is db>.o\eied as dis>. iosed in Maksta (see excerpts ahose) tails to meet 

the c\enf managet module adapted. k>i teec \ mg lesuits ul the scanning tiom the seannum 
module the event managei module adapted tu execute an esenr ha^ed on the tesuhs oi the 
scanning as damitd b\ appellant funphas's added) Mmph mm hue m Mai tta is theie am 
suggestion or an e\ ent manage t modu'e that is adapted foi iceen inn tesults of the scanning 
and v adapted to execute an e\ ent based on the je-adts nt the sunning as 1 1 timed 

in the Adstsoiv \ciion dated ^ 16 200* the 1 vamsnei has tehed on patamap h [ f H74j of Makita 
in amumg that the ( PI m Makita -.ends a tequest to the sunnum module to scan ios data 1 hus 
the Examines has concluded that the scanning module must be adapted tot ldentiHitig the 
ieques-ts hom she t PI since it i c adapted to iecene tequest tot a data -can 
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\ppei!ant iespeukilh <issetts rhtjt Maktta metd\ teache-, tlhit 1 [w jhen <i(nmm<ind to reund 
mfotni.mon on the: tecunhng medium 4 is supplied ftom the host computet 1 10 (step S"- 1 } 
inhumation to be tecosded corresponding to the .ommand is supplied to the \ uus check engine 
umt *f 1 V f emphasis added) Thus the \nu> check engine in Makita is not adapted ioi 
Kk'utilwng ieque>ts miuc no tcqucot is e\et made b\ the lu\>t computet in paiticulai the 
mloinutmn. tn Makita is sunplv supplied to th*. ssius cSkU\ engine .mil a ternie^t is not utih/ed. 
1 o emphasise the host computer tn Mat da does not send a request to the scannei but simph 
■,end\ the mfounatson to the s^annei Huts the ow'tune; tn Maktta does not lun e a tequest to 
tdemifx oi iespuitd to since it is onh the mtoink ttoo Jheif which being sent to the scannei and 
not a request . 

In addition, in the Advisory Action dated 5/16/2005, the Examiner has relied on the file 
management unit as described in Makita paragraph [0091], in supporting the present rejection. 
However, appellant respectfully asserts that such file management unit simply manages 'the 
storage of files into, the readout and deletion of files from, and access rights to the recording 
medium 4 of the external storage 120" ([00913). Tims, the file management unit only manages 
files with respect to the recording medium. 

"In Makita, the only mention of scanning such files relates to scann ing them when information is 
read out from the recording medium (see paragraph [0181 ]), Then, after the scanning, it is 
determined whether the file is transferred to a host computer (see paragraphs [0i82]-[01 84]). 
Since the file management unit only manages files with respect to the recording medium, such 
file management unit does not manage files with respect to their transmission from the virus 
check unit, to the host computer. Therefore, clearly appellant's claimed "event manager module 
coupled to the scanning module and the central processing unit, the event, manager module 
adapted for receiving results of the scanning from the scanning module, the event manager 
module adapted to execute an event ba sed on the results of the scanning" has not been met by the 
Makita reference. 

Again, at least the third element of the prima facie case of obviousness has not been met, since 
the prior art references, when combined, fail to teach or suggest all of the claim limitations, as 
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noted above. A notice of allowance or a specific prior art showing of all of appellant's claim 
limitations, in combination with the remaining claim elements, is respectfully requested. 

Group ft 3: Claims 6 and 22 

With respect to dependent Claim 6 et al, the Examiner has relied on Makita's paragraph [021 3] 
to meet appellant's claimed technique "wherein the scanning module includes software." 
Appellant respectfully asserts that paragraph [021 3] of Makita simply teaches that the 'Virus 
check can be performed even if a virus check program is not installed on the host computer ." 
Thus, the only virus check software program disclosed in Makita relates to a virus checker on the 
host.. computer , and not that the scanning module (i.e. virus checker) includes software. 

Again, at least the third element of the prima facie case of obviousness has not been met, since 
the prior art references, when combined, tail to teach or suggest all of the claim limitations, as 
noted above. A notice of allowance or a specific prior art showing of all of appellant's claim 
limitations, in combination with the remaining claim elements, is respectfully requested. 

Group # 4: Claims 7 and 23 

With respect to dependent Claim 7 et al., the Examiner has relied on Figure 15 of Makita to meet 
appellant's claimed technique "wherein the scanning module includes hardware." Appellant 
respectfully asserts that Figure 1 5 merely shows that the virus check unit 413 is included in the 
external storage 4 (which may include logic stored on the external storage 4) and not that the 
virus check unit includes hardware itself. 

Again, at least the third element of the prima facie case of obviousness has not been met, since 
the prior art references, when combined, tail to teach or suggest all of the claim limitations, as 
noted above. A notice of allowance or a specific prior art showing of all of appellant's claim 
limitations, in combination with the remaining claim elements, is respectfully requested. 

Group # 5: Claims J 2, 13 and 28 
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With respect to dependent Claim 1 2 et al, the Examiner has relied on paragraph [0! 83] of 
Makita to make a prior ail showing of appellant's claimed technique "wherein the event includes 
disabling the scanning module in response to the event." Appellant respectfully asserts that the 
above cited reference from Makita merely teaches that "a transmission to the host computer 1 10 
is stopped" {[0183]). Thus, there is simply no disclosure of any sort of "disabling [of) the 
scanning module" and especially not "in response to the event," as claimed by appellant. 

Again, at least the third element of the prima facie case of obviousness has not been met, since 
the prior art references, when combined, fail to teach or suggest all of the claim limitations, as 
noted above. A notice of allowance or a specific prior art showing of all of appellant's claim 
limitations, in combination with the remaining claim elements, is respectfully requested. 

Group U6: Claims 1 4 ami 30 

With respect to dependent Claim 14 et a!, the Examiner has relied on Makita's teaching of 

formatting the recording medium { [0053]-[OO54]) to make a prior art showing of appellant's 
claimed technique "wherein the scanning includes content scanning." The Examiner has stated 
that content scanning is used to determine a format of the data and to format the data. However, 
Makita clearly only teaches formatting the recording .medium (see specifically paragraph [0054]) 
and not providi ng content scanni ng of the requested data, for malicious code, in the manner 
claimed by appellant. 

Again , at least the third element of the prima facie case of ob viousness has not been met, since 
the prior art references, when combined, fail to teach or suggest ail of the claim limitations, as 
noted above. A notice of allowance or a spec ific prior art showing of all of appellant's claim 
limitations, in combination with the remaining claim elements, is respectfully requested. 

Group # 7: Claim 40 

With respect to dependent Claim 40, the Examiner has continued to rely on Flint's disclosed 
system where "[t]he user or administrator also faces the challenges inherent in maintaining the 
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external database" (Col, 2, lines 19-20) to make a prior art showing of appellant's claimed 
technique "wherein the user includes a .remote administrator." 

Appellant respectfully asserts that Flint's basic mention of an administrator that maintains an 
external database does not meet appellant's tl user [that] includes a remote administrator ' (Claim 
40) in the context of appellant's claim language., such that the "user is allowed to disable the 
scanning module'" (see independent Claim i). 

In the Advisory Action dated 5/1 6/2005, the Examiner argued that Flint does not provide support 
for a user being an administrator, but thai Flint discloses that a user or administrator can maintain 
a similar system to that of Makita's and appellant's. The Examiner then concludes by stating 
that "Flint provides support that a user can be an administrator. 5 ' 

Appellant fespcetliilh assert-, that the 1 >annnei s atgumeuts aie uut cleat 1 u>t die ( van n net 
states that 1 but does not support a usei being an admsmsn aHn and thai the 1 vantnu goes i>n to 
state that Mint dots pumde support that a user v. an be an admmtsnator \ppeliant agam argues 
that the onlv administrator disclosed m F but telates to an adnumstuuoj \%ho maintains a 
database, and not a temote adrnms^fatot %\ ho can doable the sianmng module a^ danned bv 
appellant (see Claim 40 which depends from Claim 1 }. 

Again, at least the third element of the prima facie case of obviousness has not been met; since 
the prior art references, when combined, fail to teach or suggest Mi of the claim limitations, as 
noted above. A notice of allowance or a specific prior art showing of Ml of appellant's claim 
limitations, in combination with the remaining claim elements, is respectfully requested. 

Issue # 3: 

The Examiner has rejected Claim 41 under 35 U.S.C. 103(a) as being unpatentable over Makita, 
U.S. Patent No. 2001/0007120, in view of Flint, U.S. Patent No. 6,735,700, m further view of 

Browne, U.S. Patent No. 6,272,533. 

Group il 1: Claim 41 
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\\ ith iespu.1 to dependent Ckum 41 the Kviminef ha* telicd ots Bioune to make a puot art 
show mg of appellant s claimed technique 1 wherein the uses in aHosved to disable the stutage and 
the data rs ptecluded from being tt ausmnted to the \toiase from the central piocesssng una upon 
the divibhng of the atoiagc " Spen+lcalK the Fxamiiiei ha\ stated that Biowne disclose^ a 
secure computing ^Wem in which a manual <-\%iVh cat) be pressed m.> that data is precluded ftom 
being written to a storage device. 

Appellant, respectfully asserts that Browne merely teaches the "disabling [of the] alteration of 
data residing on a mass storage device" (see Abstract). Thus, simply disabling the alteration of 
data , as in Browne, does not meet appel lant's specifically claimed "disabling of the storage " let 
alone disabling the storage such that "data is precluded from being transmitted to the storage 
from the central processing unit upon the disabling of the storage." 

Again, appellant respectfully asserts that at least the third element of the prima facie case of 
obviousness has not been met, since the prior art references, when combined, fail to teach or 
suggest. a|1 of the claim limitations, as noted above. 

In view of the remarks set forth hereinabove, all of the independent claims are deemed 
allowable, along with any claims depending therefrom. 
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VIH CLAIMS APPENDIX (37 C.FJL § 41.37(c)(l)(viii)) 

The text of the claims involved in the appeal (along with associated status information) is set 
forth below: 

The text of the claims involved in the appeal (along with associated status information) is 
set forth below: 

1 . (Previously Presented) A method for scanning data read from storage, 
comprising: 

a) receiving a request for data saved in storage from a central processing unit; 

b) scanning the requested data for malicious code; and 

c) transmitting the data from the storage to the central processing unit if malicious 

code ts not found in the data during the scanning; 

wherein the scanning is performed by a scanning module coupled to a storage subsystem 
controller; 

wherein a user is allowed to disable the scanning module, and data is precluded from 
being transmitted from the storage to the central processing uni t upon the disabling of the 
scanning module, 

2. (Original) The method as recited in claim 1 , wherein the storage is selected from 
the group consisting of a hard drive, compact disc-read only memory (CD-ROM), and a floppy- 
disk. 

3. (Cancelled) 

4. (Previously Presented) The method as recited in claim 1, wherein the storage 
subsystem controller is coupled to a storage driver which is coupled to the central processing 
unit, where the storage driver is coupled between the storage subsystem controller and the central 
processing unit, so that the storage subsystem controller and the central processing unit must 
communicate therethrough. 
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5. (Previously Presented) The method as recited in claim I, wherein the storage 
subsystem controller is coupled to the storage. 

6. (Previously Presented) The method as recited in claim 1 , wherein the scanning 
module includes software, 

7. (Previously Presented) The method as recited in claim 1 , wherein the scanning 
module includes hardware. 

8. (Cancelled) 

9. (Cancelled) 

10. (Original) The method as recited in claim 1, and further comprising executing an 
event based on results of the scanning. 

1 1. (Original) The method as recited in claim 10, wherein the event includes an alert. 

1 2. (Original) The method as recited in claim 1 0, and further comprising disabling the 
scanning module in response to the event. 

13. (Original) The method as recited in claim 12, wherein data is precluded from 
being transmitted from the storage to the central processing unit upon the disabling of the 
scanning module. 

1 4. (Original) The method as recited in claim 1 , wherein the scanning includes 
content scanning. 

15. (Original) The method as recited in claim 1, wherein the scanning includes virus 
scanning. 
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16. (Original) The method as recited in claim 1, wherein the storage is accessible via 
a network. 

! 7. (Previously Presented) A computer program product for scanning data read from 
storage, comprising: 

a) computer code for receiving a request for data saved in storage from a central 
processing unit; 

b) computer code for scanning the requested data for malicious code; and 

c) computer code tor transmitting the data from the storage to the centra! processing 
unit if malicious code is not found in the data daring the scanning; 

wherein the scanning is performed by a scanning module coupled to a storage subsystem 
controller; 

wherein a user is allowed to disable the scanning module, and data is precluded from 
being transmitted from the storage to the central processing unit upon the disabling of the 
scanning module. 

1 8. (Original) The computer program product as recited in claim 17, wherein the 
storage is selected from the group consisting of a hard dri ve, compact disc-read only memory 
(CD-ROM), and a floppy disk. 

19. (Cancelled) 

20. (Previously Presented) The computer program product as recited in claim .1 1, 
wherein the storage subsystem controller is coupled to a storage driver which is coupled to the 
central processing unit, where the storage driver is coupled between the storage subsystem 
controller and the central processing unit, so that the storage subsystem controller and the centra! 
processing unit must communicate therethrough. 

2 1 . (Previously Presented) The computer program product as recited in claim 1 7, 
wherein the storage subsystem controller is coupled to the storage. 
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22. (Previously Presented) The computer program product as recited in claim 1 7, 
wherein the scanning module includes software. 

23. (Previously Presented) The computer program product as recited in claim 17, 
wherein the scanning module includes hardware. 

24. (Cancelled) 

25. (Cancelled) 

26. (Original) The computer program product as recited in claim 1 9, and further 
comprising compu ter code for exec uting an event based on results of the scanning. 

27. (Original) The computer program product as recited in claim 26, wherein the 

event includes an alert. 

28. (Original) The computer program product as recited in claim 26, and further 
comprising computer code for disabling the scanning module in response to the event. 

29. (Original) The computer program product as recited in claim 28, wherein data is 
precluded from being transmitted from the storage to the central processing unit upon the 
disabl ing of the scanning module. 

30. (Original) The computer program product as recited in claim 1 7, wherein the 
scanning includes content scanning. 

3 1 . (Original) The computer program product as recited in claim .1 7, wherein the 
scanning includes vims scanning. 

32. (Original) The computer program product as recited in claim 1 7, wherein the 
storage is accessible via a network. 



33. (Previously Presented) A method for scanning data written to storage, comprising: 

a) receiving a request: for data to be written in storage, the request being received 
from a central processing unit; 

b) scanning the data for malicious code; and 

c) writing the data to the storage if malicious code is not found in the data during the 
scanning; 

wherein the scanning is performed by a scanning module coupled to a storage subsystem 
controller; 

wherein a user is allowed to disable the scanning module, and data is precluded from 
being transmitted to the storage from the central processing unit upon the disabling of the 
scanning module, 

34. (Previously Presented) A computer program product for scanning data written to 
storage, comprising: 

a) computer code for receiving a request for data to be written in storage, the request 
being received from a central processing unit; 

b) computer code for scanning the data for malicious code; and 

c) computer code for writing the data to the storage if malicious code is not found in 
the data during the scanning; 

wherein the scanning is performed by a scanning module coupled to a storage subsystem 
controller; 

wherein a user is allowed to disable the scanning module, and data is precluded from 
being transmitted to the storage from the central processing unit upon the disabling of the 
scanning module. 

35. (Previously Presented) A. system for scanning data read from storage, comprising: 

a) storage for saving data therein; 

b) a storage subsystem controller coupled to the storage for controlling access to the 
data saved therein; 

c) a central processing unit coupled to the storage subsystem controller for issuing 
read requests for reading the data saved therein for processing purposes, and write requests for 
writing data to the storage; 
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d) a scanning module Loitpled so the cenual ptocessmg mm and the storage 
suhsv-sjcm contiollej the scanning module adapted for identifying the tcque-.ts from the cenual 
processing unit and scanning the data for rnahaous code in response to The tequestv and 

c) an c\ ent manage* module coupled to the scanning module and the central 
pttxessiiHi unit, the e\ent manager moduli; adapted ioi receiving K-sults of the scanning ftom the 
scanning module the exent manager module adapted to execute an exent based on the tesahs of 
the scanning; 

f) wherein the central processing unit is conditionally allowed to read the data saved 
in the storage and write data to the storage based on the results of the scanning; 

g) wherein a user is allowed to disable the scanning .module, and data is precluded 
from being transmitted between the storage and the central processing unit upon the disabling of 
the scanning module. 

36. (Original) The system as recited in claim 35, wherein the scanning module is 
coupled to the storage subsystem controller via a bus. 

37. (Original) The system as recited in claim 35, wherein the scanning module is 
directly coupled to the storage subsystem controller. 

38. (Previously Presented) The system as recited in claim 35, wherein the scanning 
module is coupled to the storage subsystem controller via a storage driver, where the storage 
driver is coupled between the storage subsystem controller and the central processing unit, so 
that the storage subsystem controller and ihe central processing unit must communicate 
therethrough. 

39. (Previously Presented) A. system for scanning data read from storage, comprising: 

a) means for saving data therein; 

b) means for controlling access to the data saved therein; 

c) means for issuing read requests for reading the data saved therein for processing 
purposes and write requests for writing data to the storage; 

d) means for identifying the requests from the central processing unit, and scanning 
the data for malicious code in response to the requests; and 
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e) means for receiving results of the scanning from the scanning module, the event 
manager module adapted to execute an event based on the results of the scanning; 

f) wherein the central processing units is conditionally allowed to read the data 
saved in the storage and write data to the storage based on the results of the scanning; 

g) wherein a user is allowed to disable the scanning module, and data is precluded 
from being transmitted between the storage and the central processing unit upon the disabling of 
the scanning module, 

40. (Previously Presented) The method as recited in claim i, wherein the user 
includes a remote administrator, 

41. (Previously Presented) The method as recited in claim 3 , wherein the user is 
allowed to disable the storage, and the data is precluded from being transmitted to the storage 
from the central processing unit, upon the disabling of the storage. 

42. (Previously Presented) The method as recited in claim 4 1 , wherein it is 
determined whether the storage is disabled, only after determining whether the scanning module 
is disabled. 

43. (Previously Presented) The method as recited in claim 42, wherein the disabling 
and enabling of the storage and the scanning module provides increased functionality in 
conditionally precluding transmission of the data to the storage from the cen tral processing unit. 
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IX EVIDENCE APPENDIX (37 CF.R, § 4137{c)(I)(lv)) 
There is no such evidence. 
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X RELATED PROCEEDING APPENDIX (37 C.F.R. § 41,37(c)(l){x» 
There is no such related proceeding. 
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In the event a telephone conversation would expedite the prosecution of this application, the 
Examiner may reach the undersigned at (408) 971-2573. For payment of any additional fees due 
in connection with the filing of this paper, the Commissioner is authorized to charge such fees to 
Deposit Account No. 50-1351 (Order No. NAHP020). 



Respectfully submitted, 



By: /KEVINZILKA/ Date; October 22, 2007 
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